Linux Commands A-Z Part 3: echo, find, grep, firewall-cmd, free, fsck and More with Examples

echo in depth: print text, variables and escape codes

Why do we need this?

Scripts must tell the user what is happening, write lines into files and show variable values while you debug. echo is the simplest way to print anything.

What is it?

echo is a shell builtin that prints its arguments followed by a new line. The shell expands variables and wildcards before echo sees them, so quoting decides what you get. For exact formatting, printf is safer.

Common options

How to do it (step by step)

1. Print a message.

echo "Backup started"

Output:

Backup started

What it means: Text plus a new line.

2. Show a variable.

echo "User is $USER on $HOSTNAME"

Output:

User is ec2-user on web01

What it means: Double quotes expand variables.

3. Stop expansion.

echo 'Cost is $5'

Output:

Cost is $5

What it means: Single quotes keep $ as it is.

4. Use a tab.

echo -e "name\tcity\nRavi\tPune"

Output:

name	city
Ravi	Pune

What it means: -e turns \t into a tab and \n into a new line.

5. Write to a file.

echo "server=10.0.1.5" | sudo tee -a /etc/app.conf

Output:

server=10.0.1.5

What it means: tee -a appends as root; plain sudo echo >> fails.

6. Check if the last command worked.

ls /nope; echo $?

Output:

ls: cannot access '/nope': No such file or directory
2

What it means: 0 means success; anything else is an error.

Practise this in the tasks below: Practice tasks

env in depth: see and change the environment of a command

Why do we need this?

A program behaves differently depending on variables like PATH, LANG, TZ or JAVA_HOME. When something works for you but not in cron or for another user, the environment is usually the reason.

What is it?

env prints all exported variables, or runs one command with extra or removed variables, without changing your shell. It is also used in script first lines as #!/usr/bin/env python3 to find the program in PATH.

Common options

How to do it (step by step)

1. List everything.

env | sort | head -4

Output:

HISTSIZE=1000
HOME=/home/ec2-user
LANG=C.UTF-8
LOGNAME=ec2-user

What it means: Each line is NAME=value.

2. Find one variable.

env | grep ^PATH=

Output:

PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin

What it means: Folders searched for commands, in order.

3. Run one command in another time zone.

env TZ=Asia/Kolkata date

Output:

Mon Oct 26 01:30:00 IST 2026

What it means: Only this command sees TZ; your shell is unchanged.

4. Test like cron does.

env -i /bin/bash -c 'echo "PATH=$PATH"'

Output:

PATH=/usr/local/bin:/usr/bin

What it means: With an empty environment bash uses a tiny default PATH, like cron.

Practise this in the tasks below: Practice tasks

exit in depth: leave a shell and return a status

Why do we need this?

Scripts must tell cron, CI pipelines and other scripts whether they worked. That message is the exit code, and exit sets it.

What is it?

exit is a builtin that ends the current shell or script with a number from 0 to 255. 0 means success. In a login session it logs you out. In a function, use return instead.

Common options

How to do it (step by step)

1. Write a check script.

printf '#!/bin/bash\n[ -f /etc/app.conf ] || { echo missing; exit 1; }\necho ok\n' > chk.sh; chmod +x chk.sh

What it means: The script stops with 1 if the file is missing.

2. Run it and read the code.

./chk.sh; echo "code=$?"

Output:

missing
code=1

What it means: Callers see 1 and know it failed.

3. Use it in a chain.

./chk.sh && echo "deploy"

Output:

missing

What it means: && runs the next part only on exit 0.

4. Leave an SSH session.

exit

Output:

logout
Connection to 10.0.1.5 closed.

What it means: You are back on your own machine.

Practise this in the tasks below: Practice tasks

export in depth: pass variables to child programs

Why do we need this?

You set JAVA_HOME or AWS_PROFILE in your shell, but the program you start does not see it. A plain variable stays inside the shell; export passes it on.

What is it?

export marks a shell variable so it is copied into the environment of every command started from this shell. It does not affect the parent shell or other terminals. Put it in ~/.bashrc or /etc/profile.d/ to keep it.

Common options

How to do it (step by step)

1. A plain variable is not passed.

APP_ENV=prod; bash -c 'echo "[$APP_ENV]"'

Output:

[]

What it means: The child shell does not see it.

2. Export it.

export APP_ENV=prod; bash -c 'echo "[$APP_ENV]"'

Output:

[prod]

What it means: Now every child sees it.

3. Add a tool folder to PATH.

export PATH="$PATH:/opt/tools/bin"; command -v mytool

Output:

/opt/tools/bin/mytool

What it means: The shell now finds the tool.

4. Keep it for all users.

echo 'export JAVA_HOME=/usr/lib/jvm/java-17' | sudo tee /etc/profile.d/java.sh

Output:

export JAVA_HOME=/usr/lib/jvm/java-17

What it means: New login shells load files in /etc/profile.d/.

Practise this in the tasks below: Practice tasks

expr in depth: simple maths and string checks

Why do we need this?

Old scripts and very small systems (like routers with BusyBox) use expr for maths and string length. You will meet it when you read legacy scripts.

What is it?

expr evaluates an expression made of separate words and prints the result. Each number and operator must be a separate argument, and * must be escaped. In bash, $(( )) is faster and cleaner.

Common options

How to do it (step by step)

1. Add two numbers.

expr 40 + 2

Output:

42

What it means: Spaces around + are required.

2. Multiply.

expr 7 \* 6

Output:

42

What it means: Without the backslash the shell expands * as a wildcard.

3. String length.

expr length "PuneCity"

Output:

8

What it means: Counts characters.

4. Same in modern bash.

echo $(( 7 * 6 )); s=PuneCity; echo ${#s}

Output:

42
8

What it means: Prefer these in bash scripts.

Practise this in the tasks below: Practice tasks

fdisk in depth: list and create disk partitions

Why do we need this?

A new data disk arrives empty. Before you can make a filesystem and mount it, you often need a partition on it. fdisk is the classic tool, and fdisk -l is the fastest way to see every disk.

What is it?

fdisk is an interactive menu tool for MBR and GPT partition tables. Changes stay in memory until you press w. For scripts, use parted or sfdisk. After creating a partition, run partprobe or reboot so the kernel sees it.

Common options

How to do it (step by step)

1. Find the new disk.

sudo fdisk -l | grep "^Disk /dev"

Output:

Disk /dev/nvme0n1: 20 GiB, 21474836480 bytes
Disk /dev/nvme1n1: 50 GiB, 53687091200 bytes

What it means: nvme1n1 is the new 50 GiB disk.

2. Open it.

sudo fdisk /dev/nvme1n1

Output:

Command (m for help):

What it means: You are inside the menu. Nothing is changed yet.

3. Make one partition using the whole disk.

n, p, 1, Enter, Enter, w

Output:

Created a new partition 1 of type 'Linux' and of size 50 GiB.
The partition table has been altered.

What it means: Default start and end use the whole disk; w saves.

4. Confirm.

lsblk /dev/nvme1n1

Output:

NAME        SIZE TYPE
nvme1n1      50G disk
└─nvme1n1p1  50G part

What it means: The new partition p1 is ready for mkfs.

Practise this in the tasks below: Practice tasks

fg in depth: bring a background job back

Why do we need this?

You pressed Ctrl+Z by mistake in vim, or sent a long copy to the background and now need to answer its question. fg brings the job back to the front.

What is it?

fg is a shell builtin. It moves a stopped or background job of this shell to the foreground so it owns the keyboard again. Jobs are numbered; see them with jobs. bg resumes in the background instead.

Common options

How to do it (step by step)

1. Start an edit and stop it.

vim notes.txt  (then Ctrl+Z)

Output:

[1]+  Stopped                 vim notes.txt

What it means: Job 1 is paused, not closed.

2. Start a long job in the background.

sleep 600 &

Output:

[2] 4821

What it means: Job 2, PID 4821.

3. List them.

jobs

Output:

[1]+  Stopped                 vim notes.txt
[2]-  Running                 sleep 600 &

What it means: + is the current job, - the one before.

4. Return to vim.

fg %1

Output:

(vim opens again with your text)

What it means: Your unsaved work is still there.

Practise this in the tasks below: Practice tasks

file in depth: what kind of file is this?

Why do we need this?

A file named report.pdf might really be a zip, a script or a virus. Uploads, downloads and old backups often have wrong or no extensions. file checks the content, not the name.

What is it?

file reads the first bytes of a file (its "magic number") and compares them with a database to name the type. It also tells text encoding, line endings and whether a program is 32 or 64 bit.

Common options

How to do it (step by step)

1. Check a suspicious upload.

file invoice.pdf

Output:

invoice.pdf: Zip archive data, at least v2.0 to extract

What it means: It is a zip, not a PDF. Do not open it blindly.

2. Check a script from Windows.

file deploy.sh

Output:

deploy.sh: Bourne-Again shell script, ASCII text executable, with CRLF line terminators

What it means: CRLF breaks bash; fix with dos2unix or sed.

3. Check a binary.

file /usr/bin/ls

Output:

/usr/bin/ls: ELF 64-bit LSB pie executable, x86-64, dynamically linked

What it means: 64-bit Intel or AMD program.

4. Is a new disk formatted?

sudo file -s /dev/nvme1n1p1

Output:

/dev/nvme1n1p1: data

What it means: "data" means no filesystem yet.

Practise this in the tasks below: Practice tasks

find in depth: search files by name, size, time and owner

Why do we need this?

Disks fill with old logs, someone asks where a config lives, or security wants every world-writable file. find answers all of these, and can act on what it finds.

What is it?

find walks a folder tree and tests every file against conditions such as -name, -type, -size, -mtime, -user and -perm. Matching files are printed, or passed to an action like -delete or -exec. It reads the disk live, unlike locate.

Common options

How to do it (step by step)

1. Find a config file.

sudo find /etc -name "nginx.conf"

Output:

/etc/nginx/nginx.conf

What it means: Always quote patterns so the shell does not expand them.

2. Big files on the root disk.

sudo find / -xdev -type f -size +500M 2>/dev/null

Output:

/var/log/app/debug.log
/home/ravi/old.iso

What it means: -xdev stays on one filesystem.

3. Old logs.

find /var/log/app -name "*.log" -mtime +30

Output:

/var/log/app/app-2026-09-01.log

What it means: Changed more than 30 days ago.

4. Delete them safely: list first, then delete.

find /var/log/app -name "*.log" -mtime +30 -delete

What it means: Same test, now with -delete. Put -delete last.

5. Run a command on matches.

find /srv/app -name "*.sh" -exec chmod 750 {} +

What it means: {} is the file list; + passes many files at once.

6. Security check: world-writable files.

sudo find /srv -type f -perm -o+w

Output:

/srv/upload/tmp.txt

What it means: Anyone can change these; fix them.

7. Files changed in the last hour.

sudo find /etc -mmin -60 -type f

Output:

/etc/resolv.conf

What it means: Who touched config just now?

Practise this in the tasks below: Practice tasks

firewall-cmd in depth: open ports safely on RHEL

Why do we need this?

You installed a web server but nobody can reach it. On RHEL, Rocky and Fedora, firewalld blocks ports by default, and firewall-cmd is how you open them without breaking SSH.

What is it?

firewall-cmd talks to the firewalld service. Rules are grouped into zones (public, internal, trusted). A rule without --permanent is lost on reload; with --permanent it is saved but needs --reload to apply. Use both, or --runtime-to-permanent.

Common options

How to do it (step by step)

1. Check it runs.

sudo firewall-cmd --state

Output:

running

What it means: firewalld is active.

2. See the rules.

sudo firewall-cmd --list-all

Output:

public (active)
  interfaces: eth0
  services: cockpit dhcpv6-client ssh
  ports:

What it means: Only ssh, cockpit and dhcpv6 are open.

3. Open HTTP and HTTPS for good.

sudo firewall-cmd --permanent --add-service={http,https}

Output:

success

What it means: Saved, not yet live.

4. Apply.

sudo firewall-cmd --reload

Output:

success

What it means: Saved rules are now live.

5. Confirm.

sudo firewall-cmd --list-services

Output:

cockpit dhcpv6-client http https ssh

What it means: http and https are open.

6. Allow a port only from one network.

sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/16 port port=5432 protocol=tcp accept'

Output:

success

What it means: PostgreSQL only from the internal network.

Practise this in the tasks below: Practice tasks

free in depth: how much memory is really free?

Why do we need this?

An app is slow or was killed, and you need to know if the server ran out of RAM. free gives the answer in one line, if you read the right column.

What is it?

free reads /proc/meminfo and shows total, used, free, shared, buff/cache and available memory, plus swap. Linux uses spare RAM for cache, so "free" looks small; "available" is what new programs can really get.

Common options

How to do it (step by step)

1. Read memory.

free -h

Output:

               total        used        free      shared  buff/cache   available
Mem:           7.6Gi       2.1Gi       320Mi        12Mi       5.2Gi       5.3Gi
Swap:          2.0Gi          0B       2.0Gi

What it means: Free is 320 Mi, but 5.3 Gi is available because cache can be dropped.

2. Only the available number.

free -m | awk '/^Mem:/{print $7}'

Output:

5427

What it means: Good for monitoring scripts.

3. Watch it during a load test.

free -h -s 5

Output:

(prints every 5 seconds)

What it means: See if available keeps falling.

4. Was something killed?

sudo dmesg -T | grep -i "out of memory"

Output:

[Mon Oct 26 00:12:03 2026] Out of memory: Killed process 3120 (java)

What it means: The kernel OOM killer stopped java.

Practise this in the tasks below: Practice tasks

fsck in depth: check and repair a filesystem

Why do we need this?

After a power cut or a crash, a filesystem can have broken links, and the server may drop into emergency mode at boot. fsck checks and repairs it.

What is it?

fsck is a front end that calls the right checker, like e2fsck for ext4. Run it only on an unmounted filesystem or you can cause damage. XFS uses xfs_repair instead; fsck on XFS does nothing.

Common options

How to do it (step by step)

1. Find the filesystem type.

lsblk -f /dev/nvme1n1

Output:

NAME      FSTYPE MOUNTPOINT
nvme1n1p1 ext4   /data

What it means: ext4, mounted on /data.

2. Unmount first.

sudo umount /data

What it means: fsck must not run on a mounted filesystem.

3. Dry run.

sudo fsck -n /dev/nvme1n1p1

Output:

e2fsck 1.46.5
/dev/nvme1n1p1: clean, 11/3276800 files, 251161/13107200 blocks

What it means: -n only reports. Clean means no damage.

4. Force a full check and repair.

sudo fsck -fy /dev/nvme1n1p1

Output:

Pass 1: Checking inodes, blocks, and sizes
...
Pass 5: Checking group summary information

What it means: Five passes; -y fixes anything found.

5. Mount again.

sudo mount /data && df -h /data

Output:

/dev/nvme1n1p1   49G   24K   47G   1% /data

What it means: Back in service.

Practise this in the tasks below: Practice tasks

fuser in depth: who is using this file or port?

Why do we need this?

umount says "target is busy", or a port is already in use and the new service will not start. You need to know which process holds it. fuser tells you in one line.

What is it?

fuser prints the PIDs of processes using a file, a folder, a mount or a network port. Letters after the PID show how it is used: c current folder, f open file, e running program, m mapped file. It can also kill those processes.

Common options

How to do it (step by step)

1. Unmount fails.

sudo umount /data

Output:

umount: /data: target is busy.

What it means: Something still uses /data.

2. Find who.

sudo fuser -vm /data

Output:

                     USER        PID ACCESS COMMAND
/data:               ravi       2210 ..c.. bash

What it means: User ravi has a shell sitting in /data.

3. Who holds port 80?

sudo fuser -v 80/tcp

Output:

                     USER        PID ACCESS COMMAND
80/tcp:              root       1043 F.... nginx

What it means: nginx already listens on 80.

4. Ask, then kill.

sudo fuser -kim /data

Output:

/data: 2210c
Kill process 2210 ? (y/N) y

What it means: After that umount works.

Practise this in the tasks below: Practice tasks

getent in depth: look up users, groups and hosts the system way

Why do we need this?

On servers joined to LDAP or Active Directory, users are not in /etc/passwd, so grep finds nothing. getent asks the same sources the system uses for logins and name lookups.

What is it?

getent reads databases through NSS, as set in /etc/nsswitch.conf: passwd, group, hosts, services and more. It returns lines in the classic file format, from files, SSSD, LDAP or DNS.

Common options

How to do it (step by step)

1. Check a user.

getent passwd ravi

Output:

ravi:x:1001:1001:Ravi:/home/ravi:/bin/bash

What it means: Name, UID, GID, comment, home, shell.

2. A domain user grep cannot see.

getent passwd priya@corp.example.in

Output:

priya@corp.example.in:*:1855001104:1855000513:Priya:/home/priya:/bin/bash

What it means: Came from SSSD, not /etc/passwd.

3. Group members.

getent group wheel

Output:

wheel:x:10:ravi,priya

What it means: ravi and priya can use sudo.

4. Resolve the way apps do.

getent hosts db.internal

Output:

10.0.2.15       db.internal

What it means: Uses /etc/hosts and DNS in nsswitch order.

Practise this in the tasks below: Practice tasks

getfacl in depth: read extra permissions (ACLs)

Why do we need this?

Normal permissions allow only one owner and one group. When an auditor or a second team needs access, admins add ACLs. If you only look at ls -l you will miss them.

What is it?

getfacl prints the access control list of a file or folder: owner, group, named users, named groups, the mask and default ACLs for new files. A + at the end of the ls -l mode means an ACL exists. Change ACLs with setfacl.

Common options

How to do it (step by step)

1. Spot the plus sign.

ls -ld /srv/reports

Output:

drwxrwx---+ 2 app finance 4096 Oct 26 01:00 /srv/reports

What it means: + means extra ACL entries.

2. Read them.

getfacl /srv/reports

Output:

# file: srv/reports
# owner: app
# group: finance
user::rwx
user:auditor:r-x
group::rwx
mask::rwx
other::---

What it means: User auditor can read and enter.

3. Add access for one more user.

sudo setfacl -m u:priya:rx /srv/reports

What it means: priya now has read and enter.

4. Back up before changes.

getfacl -R /srv/reports > /root/reports.acl

What it means: Restore with setfacl --restore if something goes wrong.

Practise this in the tasks below: Practice tasks

grep deep dive: search text like a pro

Why do we need this?

Most admin work is finding a line: an error in a log, a setting in a config, an IP in access logs, a user in a list. grep is the tool you will use more than any other, and the most common Linux interview command after ls.

What is it?

grep reads files or input line by line and prints lines that match a pattern. The pattern is a regular expression: basic by default, extended with -E, fixed text with -F, Perl style with -P. Options control case, counting, context lines, file names and recursion. Exit code 0 means found, 1 not found, 2 error, which makes grep perfect for scripts.

Common options

How to do it (step by step)

1. Find errors in a log.

grep ERROR /var/log/app/app.log

Output:

2026-10-26 00:41:10 ERROR payment timeout id=7781
2026-10-26 00:52:33 ERROR db connection refused

What it means: Every line containing ERROR, exactly as written.

2. Ignore case and show line numbers.

grep -in "timeout" /var/log/app/app.log

Output:

118:2026-10-26 00:41:10 ERROR payment timeout id=7781
240:2026-10-26 01:02:09 WARN Timeout retry 2

What it means: Matches Timeout and timeout; the number is the line in the file.

3. Count them.

grep -c ERROR /var/log/app/app.log

Output:

37

What it means: 37 lines contain ERROR.

4. See context around an error.

grep -B2 -A3 "db connection refused" /var/log/app/app.log

Output:

(2 lines before, the match, 3 lines after)

What it means: Context shows what happened just before the failure.

5. Hide comments and blank lines in a config.

grep -Ev "^\s*(#|$)" /etc/ssh/sshd_config

Output:

Include /etc/ssh/sshd_config.d/*.conf
PermitRootLogin no
PasswordAuthentication no

What it means: -v inverts, -E allows (a|b); ^ start, $ end.

6. Two patterns at once.

grep -E "ERROR|FATAL" app.log | tail -2

Output:

2026-10-26 01:10:00 FATAL out of memory
2026-10-26 01:12:41 ERROR worker crashed

What it means: | means OR in extended regex.

7. Whole words only.

grep -w "root" /etc/passwd

Output:

root:x:0:0:root:/root:/bin/bash

What it means: Does not match chroot or rootless.

8. Pull out only the IPs.

grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" access.log | sort | uniq -c | sort -rn | head -3

Output:

  942 49.36.12.8
  311 103.21.5.90
   87 10.0.1.5

What it means: -o prints only the matched part; then count per IP.

9. Search a whole folder, only config files.

grep -rn --include="*.conf" "listen" /etc/nginx/

Output:

/etc/nginx/conf.d/shop.conf:3:    listen 443 ssl;

What it means: -r walks folders; --include limits the files.

10. Which files mention a hostname?

grep -rl "db-old.internal" /srv/app/config

Output:

/srv/app/config/prod.yml
/srv/app/config/batch.yml

What it means: Only file names: the list to update before a migration.

11. Search for text with dots or brackets as is.

grep -F "[10.0.1.5]" haproxy.log | head -1

Output:

Oct 26 01:01:02 lb1 haproxy[812]: [10.0.1.5] backend up

What it means: -F turns off regex, so [ and . are normal characters.

12. Use grep in a script.

if grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then echo SAFE; else echo FIX; fi

Output:

SAFE

What it means: -q prints nothing; the exit code drives the if.

13. Filter command output.

ps aux | grep "[n]ginx"

Output:

root  1043  0.0  0.1 nginx: master process
nginx 1044  0.0  0.2 nginx: worker process

What it means: [n] trick: the grep line itself does not match.

14. Search compressed logs.

zgrep -c "ERROR" /var/log/app/app.log.1.gz

Output:

52

What it means: zgrep reads .gz files without unpacking.

Practise this in the tasks below: Practice tasks

groupadd in depth: create a team group

Why do we need this?

Permissions are easier to manage per team than per person. Create a group like devs or finance, add people to it, and give the group access to folders.

What is it?

groupadd adds a line to /etc/group (and /etc/gshadow) with a new group name and GID. Members are added later with usermod -aG or gpasswd -a. groupdel removes a group; groupmod renames it.

Common options

How to do it (step by step)

1. Create the group.

sudo groupadd -g 3000 devs

What it means: No output means success.

2. Check it.

getent group devs

Output:

devs:x:3000:

What it means: GID 3000, no members yet.

3. Add two people.

sudo usermod -aG devs ravi; sudo usermod -aG devs priya; getent group devs

Output:

devs:x:3000:ravi,priya

What it means: -a keeps their other groups. Never forget it.

4. Give the group a shared folder.

sudo mkdir /srv/devs && sudo chgrp devs /srv/devs && sudo chmod 2770 /srv/devs

What it means: 2 (setgid) makes new files belong to devs.

Practise this in the tasks below: Practice tasks

groups in depth: which groups am I in?

Why do we need this?

You were added to the docker or wheel group but still get permission denied. The first check is: which groups does this session really have?

What is it?

groups prints the groups of the current user, or of a named user. For your own shell it shows the groups the session started with; groups added later need a new login or newgrp. id shows the same with numbers.

Common options

How to do it (step by step)

1. Check yourself.

groups

Output:

ravi wheel devs

What it means: You are in ravi, wheel and devs.

2. After being added to docker.

groups ravi

Output:

ravi : ravi wheel devs docker

What it means: The account has docker...

3. ...but this shell does not.

groups

Output:

ravi wheel devs

What it means: The session started before the change.

4. Load it.

newgrp docker; docker ps

Output:

CONTAINER ID   IMAGE   COMMAND   STATUS

What it means: Now docker works without sudo.

Practise this in the tasks below: Practice tasks

gunzip in depth: unpack .gz files

Why do we need this?

Logs are rotated as .gz, database dumps are shipped as .sql.gz, and downloads arrive as .gz. You need them back as normal files, or read them without unpacking.

What is it?

gunzip is gzip -d. It replaces file.gz with file and keeps the time stamp. -k keeps the .gz too, -c writes to the screen so you can pipe. zcat, zless and zgrep read .gz files directly.

Common options

How to do it (step by step)

1. Test first.

gunzip -t dump.sql.gz && echo OK

Output:

OK

What it means: The archive is not damaged.

2. Unpack and keep the original.

gunzip -k dump.sql.gz; ls -lh dump.sql*

Output:

-rw-r--r-- 1 ravi ravi 1.9G Oct 26 01:00 dump.sql
-rw-r--r-- 1 ravi ravi 210M Oct 26 01:00 dump.sql.gz

What it means: About 9 times smaller when packed.

3. Restore a DB without writing the big file.

gunzip -c dump.sql.gz | mysql shopdb

What it means: Saves 1.9 GB of disk.

4. Read an old log.

zcat /var/log/nginx/access.log.2.gz | tail -1

Output:

49.36.12.8 - - [24/Oct/2026:23:59:58 +0530] "GET / HTTP/1.1" 200

What it means: No file is created.

Practise this in the tasks below: Practice tasks

gzip in depth: compress files to save space

Why do we need this?

Text logs and CSV exports shrink 5 to 10 times when compressed. That saves disk, backup time and transfer cost. gzip is everywhere and fast.

What is it?

gzip compresses one file at a time and replaces it with file.gz. It does not bundle folders; use tar -czf for that. Levels go from -1 (fast) to -9 (small). Already-compressed files like JPG or MP4 barely shrink.

Common options

How to do it (step by step)

1. Compress a big log.

ls -lh app.log; gzip app.log; ls -lh app.log.gz

Output:

-rw-r--r-- 1 app app 820M app.log
-rw-r--r-- 1 app app  61M app.log.gz

What it means: 820 MB down to 61 MB.

2. See the ratio.

gzip -l app.log.gz

Output:

  compressed        uncompressed  ratio uncompressed_name
    63963136           859832320  92.6% app.log

What it means: 92.6% smaller.

3. Keep the original for now.

gzip -k -9 export.csv; ls export.csv*

Output:

export.csv  export.csv.gz

What it means: Both files remain.

4. Compress on the fly.

mysqldump shopdb | gzip > shopdb-$(date +%F).sql.gz

What it means: The dump never sits uncompressed on disk.

Practise this in the tasks below: Practice tasks

halt in depth: stop the system (and how it differs from poweroff)

Why do we need this?

Before moving a physical server or after a failed disk, you must stop it cleanly so filesystems are not damaged. Knowing halt, poweroff and shutdown avoids a server that is "off" but still drawing power, or a remote box you cannot start again.

What is it?

On systemd systems halt stops all services and the kernel but may not cut power; poweroff also turns the machine off. On a cloud VM both stop the instance. shutdown adds a delay and a warning to logged-in users.

Common options

How to do it (step by step)

1. Warn users and schedule.

sudo shutdown -h +10 "Disk swap in 10 min, save work"

Output:

Shutdown scheduled for Mon 2026-10-26 01:50:00 IST, use 'shutdown -c' to cancel.

What it means: Logged-in users see the message.

2. Change your mind.

sudo shutdown -c

What it means: The plan is cancelled.

3. Turn off now.

sudo poweroff

Output:

Connection to 10.0.1.5 closed by remote host.

What it means: Services stop, disks sync, power goes off.

4. Check last shutdowns later.

last -x shutdown | head -2

Output:

shutdown system down  5.14.0-427 Mon Oct 26 01:51 - 02:30 (00:39)

What it means: Records who and when.

Practise this in the tasks below: Practice tasks

head in depth: see the first lines of a file

Why do we need this?

A 3 GB CSV or log is too big to open. You just want to see its columns, the first records, or the start of an output. head shows only that.

What is it?

head prints the first 10 lines by default, or a number you choose with -n, or bytes with -c. With a minus number it prints all but the last N lines. It stops reading early, so it is instant on huge files.

Common options

How to do it (step by step)

1. See the CSV columns.

head -n 1 sales.csv

Output:

date,region,store,amount

What it means: Header row only.

2. Columns plus two records.

head -n 3 sales.csv

Output:

date,region,store,amount
2026-10-01,West,Pune-FC,48210
2026-10-01,West,Nashik,22050

What it means: Enough to understand the format.

3. Top 5 memory users.

ps aux --sort=-%mem | head -n 6

Output:

USER  PID %CPU %MEM COMMAND
mysql 811  3.1 41.0 /usr/sbin/mysqld
...

What it means: Header plus five processes.

4. Peek at a binary file type.

head -c 4 backup.img | od -c

Output:

0000000 177   E   L   F

What it means: \177ELF is the magic for a Linux program.

Practise this in the tasks below: Practice tasks

history in depth: find and reuse past commands

Why do we need this?

You ran a long working command last week and need it again, or you must explain what was changed on a server. history keeps a list of the commands you typed.

What is it?

history is a bash builtin. Commands are kept in memory and saved to ~/.bash_history when the shell exits. HISTSIZE and HISTFILESIZE set how many; HISTTIMEFORMAT adds dates. It is per user and can be edited, so it is not an audit log.

Common options

How to do it (step by step)

1. Add dates.

export HISTTIMEFORMAT='%F %T '; history 3

Output:

  981  2026-10-26 01:20:11 df -h
  982  2026-10-26 01:21:40 sudo systemctl restart nginx
  983  2026-10-26 01:22:02 history 3

What it means: Now you know when each ran.

2. Find a past command.

history | grep rsync

Output:

  640  rsync -avz /srv/app/ backup01:/backup/app/

What it means: Number 640 is the one you want.

3. Run it again.

!640

Output:

rsync -avz /srv/app/ backup01:/backup/app/
sending incremental file list

What it means: Bash prints the command, then runs it.

4. Forgot sudo?

sudo !!

Output:

sudo systemctl restart nginx

What it means: !! is the last command.

5. Remove a typed password.

history -d 981; history -w

What it means: Never type secrets on the command line; delete them if you did.

Practise this in the tasks below: Practice tasks

host in depth: quick DNS lookups

Why do we need this?

After a DNS change you want a quick yes or no: does this name point to the new IP? host gives a short, readable answer without the long dig output.

What is it?

host is a simple DNS lookup tool from the bind-utils (RHEL) or bind9-host (Ubuntu) package. It looks up A, AAAA and MX records by default, reverse lookups for IPs, any record type with -t, and can ask a chosen server.

Common options

How to do it (step by step)

1. Simple lookup.

host example.com

Output:

example.com has address 93.184.215.14
example.com has IPv6 address 2606:2800:21f:cb07:6820:80da:af6b:8b2c

What it means: IPv4 and IPv6 addresses.

2. Mail servers.

host -t mx gmail.com

Output:

gmail.com mail is handled by 5 gmail-smtp-in.l.google.com.

What it means: Lower number means preferred.

3. Reverse lookup.

host 8.8.8.8

Output:

8.8.8.8.in-addr.arpa domain name pointer dns.google.

What it means: The PTR name for the IP.

4. Ask a public server after a change.

host shop.example.in 1.1.1.1

Output:

Using domain server:
Address: 1.1.1.1#53

shop.example.in has address 13.235.10.20

What it means: The new IP is already visible from outside.

Practise this in the tasks below: Practice tasks